President of UODO – Court Ruling (Poland, 2021)

Applicant is the President of the Polish DPA (UODO) and defendant is a school (hereafter: controller). This appeal resulted from a decision by the DPA, in which it ordered the controller to remove certain processed' personal data of the complainant. The complainant is a teacher whose contract got terminated by the controller (her employer). She had received a notice of termination of her employment together with a statement of reasons, the content of which contained processed' personal data concerning her and her husband. She considered that she had never provided this personal data to the employer, and that this was not in line with the GDPR. Hence, she filed a complaint with the Polish DPA (UODO). In the justification for the termination of employment, the controller presented personal data obtained from public registers concerning the assets and income from complainant's business activity and agricultural activity, as one of the reasons for the termination. Furthermore, it stated that the processing of the this data resulted from the obligation to comply with all the orders imposed by law in terms of justifying the termination of the employment relationship for reasons beyond the employer's control (collective redundancies). In its decision, the DPA referred to the position of the Supreme Court in their judgement of 19 April 2019 (I PK 20/18), in which it held that the criteria for assessing the reasonableness of termination, such as family, personal or financial situation, do not fall within the concept of the reason for termination. They only constitute criteria for assessing the decision's legitimacy. In the light of the above, the DPA stated that the controller had no legal basis to process complainant's personal data obtained from publicly available public registers in the text of the termination notice, and thus violated Article 6 GDPR. Hence, the DPA ordered the controller to delete complainant's personal data concerning her assets and income from her business and agricultural activities. The controller appealed to this decision and brought the complaint to the administrative court. The Court held that the DPA did not fulfil its obligation to correctly assess the processing criterion indicated by the school, because in order to make such an assessment it is not sufficient to cite the Supreme Court's decision concerning the reasons for termination of the employment contract. According to the Court, this assessment must find support in the case under consideration, which was lacking in the justification of the decision. Regarding the Supreme Court judgment cited by the DPA, the Court indicated that there are also judgments interpreting the issues related to the selection of the criterion for termination in a different manner, as there is a divergence in the case law in this respect. The first position, which the court in the present case found to be correct, indicates that when terminating an employment contract by notice, the employer must indicate the criteria it used to terminate an employee's contract. The Court pointed out that, in this case, the controller included these criteria in the termination notice, apart from the main reason for termination (redundancy). Among these criteria, was the criterion of financial situation, which was supported by the personal data from public records and an open declaration of assets. The Court held that the controller had a legitimate interest in processing this data, and therefore could rely on the legal basis in Article 6(1)(f) GDPR. Hence, the Court found that the DPA's decision violated the law and annulled the DPA's decision.